Installation and Configuration Guide (Download)
Download the complete manual on how to install and configure EasyEntra:
Installation and Configuration Guide (Online Version)
Contents
- 1. Introduction
- 2. Preparing the Installation
- 3. Performing the Installation
- 4. Post-Installation Configuration
- 5. Operational Notes
- 6. Troubleshooting
1. Introduction
EasyEntra embodies our vision to transform hybrid and cloud-only Entra ID management into a cost-effective and genuinely pleasant experience for companies worldwide.
EasyEntra offers a single pane of glass to manage one or more Active Directories and one or more Entra ID tenants in a simple, intuitive, and highly responsive UI.
EasyEntra’s primary target audience is the first-level support teams of organizations using Active Directory, Entra ID, or both.
The visual design of EasyEntra is intentionally familiar, closely mimicking the design of AD Users & Computers (ADUC). This familiarity practically eliminates the need for training, making the transition from standard tools to EasyEntra effortless.
With EasyEntra, first-line support teams no longer need to worry about attribute authority, PowerShell usage, or slow-performing web consoles. All daily operations are available in a consolidated, intuitive, and highly responsive GUI.
The security design of EasyEntra does not include a proprietary security subsystem. All access permissions to Active Directory, Microsoft Graph, and Exchange Online are evaluated exactly as they are with the native tools. Similarly, all logging of activities remains possible using the highly trusted and certified native logging mechanisms in Active Directory (Security Access Control Lists / SACLs) and Entra ID (Unified Audit Log).
Compared to other similar solutions, this design eliminates the need for a central server or database and provides:
- Easier troubleshooting of permissions issues (only native security).
- Easy fallback to standard tools (same permissions apply).
- Zero vendor lock-in.
Additionally, EasyEntra enables you to remove your on-premises Exchange Server without resorting to PowerShell for daily user management — and without compromising security.
This guide shows you how to install and configure EasyEntra.
To find the latest information and download the most recent version of EasyEntra, visit:
https://easyentra.com
2. Preparing the Installation
This section describes how to prepare for a successful deployment of EasyEntra.
EasyEntra comes as an .msi installer and can be easily installed on or removed from your system. It is a simple executable that requires no services or changes to your Active Directory.
EasyEntra does not use a proprietary security subsystem. As a result, all accesses to Active Directory, Microsoft Graph, and Exchange Online work exactly as they would without EasyEntra. Similarly, all logging of activities remains possible using the highly trusted and certified native logging tools in Active Directory (Security Access Control Lists / SACLs) and Entra ID (Unified Audit Log).
The security design of EasyEntra eliminates the need for a central server or database, simplifies troubleshooting of permission issues (native security only), allows fallback to standard tools (same permissions apply), and avoids vendor lock-in.
2.1 Operating System
Supported operating systems:
- Windows 10 or later
- Windows Server 2019 or later
You can install EasyEntra on a domain-joined Windows client, a shared management server, a Domain Controller, or even an Entra ID-joined or standalone Windows client.
2.2 Network Communication
EasyEntra saves you the trouble of using multiple tools, web consoles, and PowerShell for daily user management. It does so by remotely connecting to the systems involved in managing a hybrid AD / Microsoft 365 environment.
As part of daily operations, EasyEntra communicates with:
- Active Directory – AD user, group, contact, and computer management
- Microsoft Entra Connect – AD-to-Entra ID synchronization
- Microsoft Graph PowerShell – Entra ID user, group, and license management
- Exchange Online – mailbox management
- SharePoint Tenant Administration API – OneDrive management
- Application Insights – optional telemetry
- EasyEntra Web Service – license validation
Active Directory communication uses LDAP (TCP 389). For secure password changes, AD requires secure RPC over SMB (TCP 445).
Microsoft Entra Connect uses WinRM (TCP 5985).
Microsoft Graph, Exchange Online, Application Insights, and EasyEntra License Service use HTTPS (TCP 443).
The EasyEntra license validation only communicates your tenant and company name, user count, and EasyEntra version number. The license service is hosted on license.easyentra.com (currently 104.43.246.71 – subject to change) and e365mweb.azurewebsites.net (currently 104.43.246.71 – subject to change). If your firewall performs application filtering, you must allow HTTP POST.
If you prefer not to let EasyEntra communicate with the license service, you can use a local license key instead. This requires additional manual steps and disables update/expiration notifications. Contact support@easyentra.com for details.
Application Insights only reports minimal anonymous stack traces in case of application failures (no client data). Error reporting is opt-in and can be enabled in EasyEntra settings.
Refer to Microsoft documentation to troubleshoot network communication with AD, Entra Connect, Entra ID, and Exchange Online.
2.3 Active Directory Schema Version
If you use EasyEntra for hybrid management, your Active Directory must include the Exchange schema attributes required for proper integration with Microsoft 365.
If you previously had Exchange 2010 SP2 or later installed on-premises, your schema already contains the necessary attributes.
If you never had Exchange on-premises, your schema might be missing essential attributes.
Refer to the EasyEntra Knowledge Base and Microsoft documentation for instructions on identifying your AD schema version and extending it with the Exchange schema updates:
https://easyentra.com/knowledge-base/the-exchange-schema-updates-are-missing-from-active-directory
You can ignore the schema requirement if you use EasyEntra for cloud-only management.
2.4 Delegation of Administrative Rights
This section lists the permissions needed to manage users, groups, contacts, and computers in a hybrid AD / Microsoft 365 environment.
The permissions are general and not specific to EasyEntra, but they are listed here for your
convenience.
Delegate these rights in advance to any administrator who will use EasyEntra.
2.4.1 Active Directory
To fully manage Active Directory users, groups, contacts, and computers, you need the following rights:
- Create / delete User objects
- Full control of User objects
- Create / delete Group objects
- Full control of Group objects
- Create / delete Contact objects
- Full control of Contact objects
- Create / delete Computer objects
- Full control of Computer objects
These permissions can be delegated to specific OUs via AD Users & Computers.
Refer to Microsoft documentation for details.
2.4.2 Entra ID
Roles required to manage Entra ID user accounts, mailboxes, and licenses:
- User Administrator
- Exchange Recipient Administrator
- Authentication Administrator (optional, for MFA management)
- Reports Reader (optional, for report generation)
- Cloud Device Administrator (optional, for LAPS and BitLocker management)
- SharePoint Administrator (optional for OneDrive management)
Roles can be assigned in the Entra ID portal or via PowerShell (with or without PIM).
You can limit user scope with Administrative Units.
Refer to Microsoft documentation for further information.
2.4.2.1 Microsoft Graph Command Line Tools
All requests to Entra ID use the Microsoft Graph PowerShell API (app ID 14d82eec-204b-4c2f-b7e8-296a70dab67e).
You must configure API consent to allow impersonation with the following permissions:
- User.ReadWrite.All
- Group.ReadWrite.All
- Device.ReadWrite.All
- UserAuthenticationMethod.ReadWrite.All
- Domain.Read.All
- Sites.Read.All
- Reports.Read.All
- AuditLog.Read.All
- Directory.AccessAsUser.All
- DeviceLocalCredential.Read.All
- BitLockerKey.Read.All
- Mail.ReadWrite.Shared
- Calendars.Read.Shared
- Contacts.Read.Shared
- RoleEligibilitySchedule.Read.Directory
- RoleAssignmentSchedule.ReadWrite.Directory
- offline_access
Most organizations, configuring an Admin Consent will be acceptable, as it doesn’t grant any new permissions – it only allows the API to impersonate user credentials. However, some organizations may require individual consent.
You’ll find more extensive information on API consent here, as well as a script to manage admin or user consent:
https://easyentra.com/configure-microsoft-graph-powershell-for-easyentra-delegation/
2.4.3 Exchange Online
To manage Exchange Online mailboxes, you need the Entra ID role Exchange Recipient Administrator (see 2.4.2).
You can limit visible mailboxes by using Management Role Scopes.
You do not need explicit Exchange Admin Roles — the Entra ID Exchange Recipient Administrator role corresponds to Recipient Management in Exchange.
Notice: To create or modify MailEnabledSecurity groups, you must have the Exchange permission Security Group Creation and Membership (or equivalent). For least-privilege access, assign it via a custom Exchange Admin Role.
Refer to Microsoft documentation for details.
2.4.3.1 Microsoft Exchange REST API-Based PowerShell
All Exchange Online requests use the Exchange Online REST API (app ID fb78d390-0c51-40cd-8e17-fdbfab77341b).
This API does not require consent.
2.4.4 SharePoint Online
To manage users’ OneDrive settings and delegation in EasyEntra, you need the Entra ID role SharePoint Administrator (see section 2.4.2).
Refer to Microsoft documentation for further information.
2.4.4.1 Microsoft SharePoint REST API-Based PowerShell
All requests to SharePoint Online are performed using the SharePoint Online REST API (app ID: 9bc3ab49-b65d-410a-85ad-de819febfddc). This API does not require any consent.
2.4.5 Microsoft Entra Connect
To perform a successful replication of Microsoft Entra Connect, you need:
- Permission to create a remote PowerShell session to the Entra Connect Server
- Permission to synchronize Microsoft Entra Connect
To verify, open PowerShell with the same credentials used by EasyEntra and run:
Enter-PSSession [Microsoft Entra Connect Server]
Start-ADSyncSyncCycle -PolicyType Delta
If you experience errors, see the subsections below.
2.4.5.1 Microsoft Entra Connect Server Remote PowerShell Permissions
To establish a remote PowerShell session, the WinRM service must be running on the Entra Connect Server, and you need permission to execute PowerShell commands.
Use the following command on the Microsoft Entra Connect Server to see if the WinRM service is
running:
(Get-Service -Name WinRM).Status
Check if you have Execute permissions on PowerShell:
Set-PSSessionConfiguration -ShowSecurityDescriptorUI -Name Microsoft.PowerShell
This command opens the PowerShell security descriptor UI. You must have Execute (or Full Control) permissions in the ACL.
You need remote PowerShell permissions even if EasyEntra is installed directly on the Entra Connect Server.
Refer to Microsoft documentation on enabling Entra ID Connect synchronization and remote PowerShell sessions.
2.4.5.2 Entra ID Connect Synchronization Permissions
To synchronize Entra ID Connect, you must be a member of the ADSyncOperators group at minimum.
If Microsoft Entra Connect is installed on a member server, this group is local.
If Microsoft Entra Connect is installed on a domain controller, it is a domain local group.
2.4.5.3 How to Run EasyEntra From an Entra ID Domain-Joined PC
To run EasyEntra from an Entra ID domain-joined PC, perform these steps:
- Ensure proper client DNS integration with your on-premises Active Directory.
- Configure Windows Credential Manager with credentials for your preferred Domain Controller and Entra Connect Server.
- Configure the WSMAN TrustedHosts list on your local client to enable remote PowerShell connection to your Microsoft Entra Connect Server.
- Configure AD Users & Computers for first use.
For detailed setup instructions, see:
https://easyentra.com/knowledge-base/how-to/how-to-run-easy-entra-from-an-entra-id-domain-joined-pc/
If you use EasyEntra for cloud-only management, no additional configuration is required.
3. Performing the Installation
Once all prerequisites are met, you can run the .msi installation file on your system.
Unless you want to change the default installation folder, there is nothing to customize.
3.1 Unattended Installation
EasyEntra supports unattended installation and removal.
Use the following command to perform an unattended installation:
msiexec /package EasyEntra-v0.0.37-x64.msi /quiet
Use the following command to perform an unattended removal:
msiexec /uninstall EasyEntra-v0.0.37-x64.msi /quiet
(Replace the .msi file name with the actual version being installed or removed.)
4. Post-Installation Configuration
You can use EasyEntra to manage pure Active Directory, cloud-only Entra ID, and hybrid environments (Active Directory synchronized with Entra ID).
- Use the Active Directory Connection Manager to connect with an Active Directory.
- Use the Entra ID Connection Manager to connect with an Entra ID.
- Use both Connection Managers to connect with a hybrid environment.
You can manage any number of Active Directories and Entra ID tenants side-by-side.
4.1 Configuring the AD Connection(s)
By default, EasyEntra will interact with Active Directory (domain controllers) and Microsoft Entra Connect using the security context of the application process token, just like AD Users & Computers. Therefore, you must start EasyEntra using a privileged account.
Apart from using the identity of the process token, EasyEntra offers an additional method of authentication: In-app authentication.
In-app authentication has two benefits:
- You can easily connect to your AD from non-domain PCs (for example, Entra-joined workstations).
- Your process will not expose admin credentials, providing full protection from token theft.
After you select your authentication method and click Next, you must enter the FQDN of the AD domain you wish to connect.
Click Next and select the domain controller you wish to connect with. Optimally, choose the domain controller from which Entra Connect is synchronizing for minimal latency.
In a hybrid environment, you must also connect with your Entra ID tenant (see next section).
4.2 Configuring the Entra ID Connection(s)
To connect to one or more Entra ID tenants, go to Connection Manager → Entra ID → Click Add, select Primary Tenant, and click Next. Log in to MS Graph and EXO, and click Finish.
Your tenant will auto-associate with your AD in EasyEntra if you have a standard single-AD single-tenant environment.
You must explicitly configure your AD connection to associate with the desired tenant if you have multiple tenants or multiple AD domains.
4.3 Microsoft 365 Authentication
Click the MS Graph login button to authenticate with Microsoft Graph PowerShell.
Click the EXO login button to authenticate with Exchange Online.
Both MS Graph and Exchange Online authentication use OAuth2, which includes the following advantages:
- EasyEntra will never know your credentials.
- EasyEntra supports multi-factor authentication (MFA), FIDO2, and Conditional Access Policies.
If authentication is successful, EasyEntra receives an access token, which is encrypted and cached to disk. The token is protected by the user and machine passwords of the system where EasyEntra is running.
The caching of the token ensures that you don’t need to authenticate every time you use EasyEntra.
You can remove the cached token and Entra ID Connect information from your system by deleting the configuration file:
C:\Users\[username]\AppData\Local\EasyEntra\EasyEntra_Config.json
Alternatively, you can start PowerShell 7 and run the following CmdLet:
Reset-EEConfiguration
4.4 Microsoft Entra Connect Server
Go to Connection Manager → On-Premises AD, double-click your AD Connection, enter the name of your Microsoft Entra Connect Server, and click OK:
You must use the hostname or fully qualified domain name (FQDN). Specifying the Microsoft Entra Connect Server by IP address is not allowed.
5. Operational Notes
This section covers several considerations to ensure the best experience running EasyEntra.
5.1 Domain Controller Selection
To ensure that your Active Directory changes are replicated as quickly as possible to Entra ID, make your AD changes on the Domain Controller preferred by Microsoft Entra Connect.
This is a general guideline and not specific to EasyEntra.
Run the following command on your Microsoft Entra Connect Server to identify the preferred Domain Controller:
((Get-ADSyncConnector).Partitions.Parameters | ? {$_.Name -eq ‘last-dc’}).value
Once identified, configure your On-Premises AD Connection in EasyEntra to use that Domain Controller:
5.2 Software Updates
EasyEntra notifies you whenever new updates are available. Notifications occur no later than 14 days after a new update is released.
First-level supporters who do not have permission to update EasyEntra (for example, on a shared management server) can disable update notifications by selecting Disabled (for any update) in the notification dialog.
5.3 License Renewal
EasyEntra notifies you when your license is 30 days away from expiration. Click the link in the notification to renew your EasyEntra license.
Renewing your license adds another year to the current expiration date, so renew as soon as possible to avoid downtime.
You can disable license renewal notifications by selecting Disabled in the notification dialog.
6. Troubleshooting
If you experience issues installing or configuring EasyEntra, refer to the online Knowledge Base for troubleshooting articles and known issues:
For additional assistance, contact EasyEntra Support:
